WASHINGTON -- Driver's licenses will become national ID cards--and Americans will be at greater risk of identity theft--under a new federal law that passed without significant congressional debate, critics charge.

The Real ID Act will require that states verify every license applicant's identity and residency status, and that they store addresses, names, and driving records in a database that every other state can access. It also mandates anticounterfeiting features for the licenses and a "common machine readable technology." In three years, licenses that don't meet the standards won't be accepted as identification for boarding an airplane, opening a bank account, or satisfying any other federally regulated use.

The law's sponsor, Rep. James Sensenbrenner (R-Wisconsin) said that the law "seeks to prevent another 9/11-type terrorist attack by disrupting terrorist travel." Opponents contend that the act is primarily meant to prevent people who illegally immigrate to the United States from getting licenses.

When he introduced the bill at a press conference earlier this year, Sensenbrenner referred to a part of the report
from the September 11 Commission that read, "Members of al-Qaida clearly valued freedom of movement as critical to their ability to plan and carry out the attacks prior to September 11th.

He said that his proposed legislation would curtail such movement and would tighten the rules for political asylum. In response to questions from reporters, he also suggested that the law was intended to "get a handle on illegal aliens in the United States."

How It Passed

The controversy surrounding the new law relates to the way it was passed as much as to what it does. Because it passed as an amendment to an emergency spending bill providing funding for American troops in Afghanistan and Iraq, the Real ID Act did not come up for a vote on its own--or for full debate--in Congress.

"This really is a national identification card for the United States of America for the first time in our history," said Sen. Lamar Alexander (R-Tennessee) in the Senate the day before the spending bill passed. "We have never done this before, and we should not be doing it without a full debate."

According to critics, what makes this a national ID--as opposed to another form of classification such as a Social Security card--is the fact that driver's licenses already serve as standard forms of identification for everything from entering a bar to boarding an airplane. Though the Real ID Act doesn't obligate states to follow the new national standards, their licenses and state IDs won't satisfy ID requirements for any purpose under federal jurisdiction unless the states comply.

Alexander and 11 other senators, evenly split between Democrats and Republicans, sent a letter to Senate Majority Leader Bill Frist (R-Tennessee) last month asking him to block the amendment.

Though Alexander strongly opposed passing the Real ID Act without debate, he said he was "reluctantly" in favor of a national ID in the wake of September 11. Other observers remain deeply concerned by the prospect.

Risk of ID Theft

"This is serious business," says Bill Scannell, a privacy advocate. If you want to board a plane, "you have to show your papers."

Scannell's Web site, UnrealID.com, gathered more than 10,000 comments in 28 hours from people asking their senators to block the amendment the day before the Senate vote. Scannell faxed all those comments to the appropriate senators, but he says that his failed last-minute attempt was "like the charge of the light brigade."

The new law, which takes effect in three years, establishes general requirements, but the Department of Homeland Security will decide how to implement the broad-brush mandates. Anyone with a license from a state that doesn't meet Real ID's standards will have to get a new license before then.

One mandate provides that every state must have a database accessible by all other states and including all of the information printed on a license as well as the person's driving record. The original proposal would have created a single national database, but this provision was changed before the Senate vote.

Nevertheless, "if you link all the databases and you mandate the sharing of the information, you have created one network," says Tim Sparapani, legislative counsel for the American Civil Liberties Union.

Sparapani says that having 51 different databases (one for each state plus Washington, D.C.) could actually be worse than having a single big one. Any computer or network is only as secure as its weakest point--the weakest link in the chain. So if 51 databases are tied together, and 50 of them have great security but one is easy to break into, the entire conglomeration is vulnerable.

"We know that any kind of sophisticated hacker, ID thief, organized criminal, or terrorist will be able to hack into this system," Sparapani says. "There are so many points of entry."

Lack of Privacy Protections

Sparapani says that the network of databases may also eventually hold electronic copies of sensitive personal documents. The law requires that states verify and store electronic copies of a driver's photo ID, birth certificate, and Social Security card, along with documents showing name and address.

The ACLU wants those documents to be stored separately from the network of driver's license databases, Sparapani says, but "it's not administratively efficient."

"States will do whatever is easiest and cheapest," he says.

The new law neither requires nor forbids that the documents be part of the same database.

"There were ample opportunities for the sponsors of the bill to build in privacy protections, and they chose not to," Sparapani says.

Machine Readable = RFID?

The requirement that licenses incorporate a "machine-readable technology" is similarly vague. Already, 47 states--all but Alaska, Oklahoma, and Wyoming--have a bar code or a magnetic stripe. Either one would satisfy the law's mandate, as would radio frequency ID (RFID), a broadcast technology planned for upcoming electronic U.S. passports.

The broad language of the new law "really allows for many possibilities," says Neville Pattinson, director of technology and government affairs at the U.S. headquarters in Austin, Texas, of the European company Axalto, which makes smart cards. A small computer chip in each card stores information and may include features such as encryption. Axalto makes both contactless chips, which use RFID, and contact chips, which must be touched to be read. The company is bidding to supply the contactless chips for the new passports.

Many privacy and travel groups have strongly protested
against using chips with RFID in passports because they can be read from a distance. Broadcasting such passport data could make targets of American travelers, they say.

The Smart Card Alliance, an industry group that includes Axalto, is pushing to use smart-card technology in driver's licenses. Pattinson says contact chips would be more appropriate, but contactless chips with RFID would also satisfy the law's requirements.

A Department of Homeland Security spokesperson, Jared Eagan, says he is not aware of any discussions regarding the technology that might be used.

Privacy Concerns Overblown?

The American Association of Motor Vehicle Administrators is "eager to work with DHS to fashion those provisions," says spokesperson Jason King. The 72-year-old organization represents state and provincial officials in the United States and Canada who administer and enforce motor vehicle laws, according to its Web site. King says that the department has not yet contacted the association.

"The driver's license framework is broken and in dire need of repair," King says. The Real ID Act "represents the first time in the history of driver's licenses that we will have consistency from state to state in how the driver's license is administered." The AAMVA favors that standardization, according to King.

"State motor vehicle administrators are very concerned about privacy," King says, but he sees the privacy concerns of the ACLU and other critics as overblown. For instance, he points out that driving records are already available online. In King's view, a provision in the law requiring security clearance for anyone who produces driver's licenses will help protect privacy.

Fear of government abuse or misuse of privacy under the new laws is misplaced, King believes. "Quite frankly, today, corporate America knows much more than [the] DMV does or ever will," he says. "We have no idea where you shop, nor do we care."

The States Weigh In

Deciding whether and how privacy concerns should be addressed is now up to DHS, with consultation from the Department of Transportation. The task of implementing those decisions, though, will fall squarely on the states.

"States are going to make their best effort with this," says Cheye Calvo, transportation committee director for the National Conference of State Legislatures. "They're not happy about it, but they're going to try to do it."

Calvo says that the new law could cost the states as much as $1 billion. In addition to purchasing new machines and technology, state DMVs will have to hire new people to scan and verify documents, he says. Virginia alone estimates that it will have to spend $237 million, according to Calvo.

The additional time required for verification could mean the end of being able to go to a DMV and get a license in the same day, Calvo says. States must verify the "issuance, validity, and completeness of each document" under the new law. Even if states streamline contacts with utility companies, hospitals, and other organizations that might supply documents, adding even 10 minutes to the time required for each of the millions of licenses involved would translate into a huge new time and manpower burden.

State Protections Removed

Calvo sees the privacy and civil liberty concerns about the new law as serious. Aside from issues involving linked databases and stored documents, he notes that the new federal law will invalidate existing state laws meant to protect judges, police, and victims of domestic violence.

For instance, some states currently allow battered women to use the address of the state attorney general's office instead of their real address on their license. But there are no exceptions to the Real ID Act's requirement that people's home address appear on their licenses.

There is a legitimate need to revise driver's license laws to prevent situations such as having licenses in two states at the same time, Calvo says. But he thinks that the issue of securing driver's licenses was taken care of in December when Congress passed the Intelligence Reform Act, which called for the Department of Transportation to revise laws in consultation with the states. Now, however, those provisions have been superseded by the Real ID Act, which was written without input from the states.

Calvo says that the flaws in the new law stem largely from its having skipped the normal process of debate in Congress. "This is why you have a deliberative process; this is why you have hearings," he says.

Adding a controversial bill like the Real ID Act to a "must-pass" bill like the emergency military spending authorization doesn't happen very often, Calvo says. "In this case it was passed for political reasons."

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.